skip logic in the plugin is broken

[hgschmie]

The plugin tries to "guess" when to create SBOM files and when to skip based on settings for other plugins (maven-deploy and the deprecated nexus staging plugin). This breaks any system that uses other plugins to deploy (especially the new central staging plugin).

The plugin should not try to guess but expose a "skip" property and leave it to the user to decide whether to skip / not skip SBOM generation.

[rvesse]

Just discovered this today myself. Sonatype have now sunset the old Sonatype OSS publishing process so everyone who publishes into Central now has to use their new process which for Maven means using their plugin which takes over normal deploy and wrongly causes CycloneDX to skip BOM generation.

Example Maven output from one of our builds where this can be seen

[INFO] Installing Central Publishing features
...
[INFO] --- cyclonedx:2.9.1:makeAggregateBom (build-sbom-cyclonedx) @ scg-server ---
[INFO] Skipping CycloneDX goal, because module skips deploy

This then fails later stages of our build workflows because they expect the SBOM files to be present and they no longer are

There is a workaround documented in #597 (comment) which is to add <skipNotDeployed> to plugin configuration but haven't verified if that works for us yet

[hboutemy]

duplicate of #597
fixed by #604